Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

This post intends to serve as a guide for a common bypass technique when you're up against a web application firewall (WAF). In the event that the WAF limits what tags and attributes are allowed to be passed, we can use BurpSuite's Intruder functionality to learn which tags are allowed. Table of Contents: Setting the…

Preventing XSS Attacks

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

XSS and CORS Bypass in - HADESS

Mastering XSS: A Comprehensive Guide for Bug Bounty Hunters, by Security Lit Limited

Understanding XSS Attacks

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

Finding DOM Polyglot XSS in PayPal the Easy Way

PDF) Cross-Site Scripting Attacks and Defensive Techniques: A Comprehensive Survey

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes